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The basics 


WE ARE COMMITTED TO PROTECTING AND RESPECTING YOUR PRIVACY. 
We will: 


e always keep your personal data safe and private; 
e never sell your personal data; and 
e allow you to manage and review your marketing choices at any time. 


1. About us 


The Revolut group is made up of different companies. We will let you know which Revolut 
company you have a relationship with when you first apply for or use a Revolut product or 


service. 


You can always tell which Revolut company you have a primary relationship with by scrolling to 


the bottom of the ‘settings’ section in the Revolut app. 


2. Why do | need to read this policy? 


We will collect your personal data when you use: 


e our website at www.revolut.com; 
e the Revolut app; or 


e any of the services you can get access to through the Revolut app or website. 


Revolut 


When we Say ‘personal data’, we mean information which can be used to personally identify you 


(for example, a combination of your name and postal address). 


THIS POLICY CONTAINS IMPORTANT INFORMATION 


This policy explains what information we collect, how we use it, and your rights if you want to 


change how we use your personal data. 


If you have concerns about how we use your personal data, you can contact our Data Protection 


Officer at dpbo@revolut.com. 


Your personal data 


3. What personal data do you collect about me 


WE COLLECT DIFFERENT TYPES OF PERSONAL DATA FROM YOU AND OTHERS 


The table below explains what personal data we collect and use. 


We collect information you provide when you: 


e fillin any forms; 

e correspond with us; 

e register to use the Revolut app; 

e open an account or use any of our services; 

e take part in online discussions, surveys or promotions; 

e speak with a member of our customer support team (either on the phone or through the 


Revolut app); 
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e enter a competition; or 


e contact us for other reasons. 


We will collect the following information: 


e Your name, address, and date of birth; 

e Your email address, phone number and details of the device you use (for example, your 
phone, computer or tablet); 

e Your Revolut username (this is random and is automatically assigned to you when you 
first join but you will be able to change it), password and other registration information; 

e Details of your bank account, including the account number, sort code and IBAN; 

e Details of your Revolut debit cards and credit cards (or other debit or credit cards you 
have registered with us) including the card number, expiry date and CVC (the last three 
digits of the number on the back of the card); 

e Identification documents (for example, your passport or driving licence), copies of any 
documents you have provided for identification purposes and any other information you 
provide to prove you are eligible to use our services; 

e Information you provide when you apply for credit, including details about your income 
and financial obligations; 

e Records of our discussions, if you contact us or we contact you (including records of 
phone calls); 

e Your image in photo or video form (where required as part of our Know-Your-Client (KYC) 


checks or where you upload a photo to your Revolut account). 


If you give us personal data about other people (such as your spouse or family), or you ask us to 
share their personal data with third parties, you confirm that you have brought this policy to their 


attention beforehand. 
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Information from your device 


Whenever you use our website or the Revolut app, we collect the following information: 


Technical information, including the internet protocol (IP) address used to connect your 
computer to the internet, your log-in information, the browser type and version, the 
time-zone setting, the operating system and platform, the type of device you use, a 
unique device identifier (for example, your device's IMEI number, the MAC address of the 
device's wireless network interface, or the mobile phone number used by the device), 
mobile network information, your mobile operating system and the type of mobile 
browser you use; 

Information about your visit, including the links you have clicked on, through and from 
our site (including date and time), services you viewed or searched for, page response 
times, download errors, length of visits to certain pages, page interaction information 
(such as scrolling and clicks), and methods used to browse away from the page; 
Information on transactions (for example, payments into and out of your account), 
including the date, time, amount, currencies, exchange rate, beneficiary details, details of 
the merchant or ATMs associated with the transaction (including merchants’ and ATMs’ 
locations), IP address of sender and receiver, sender's and receiver's name and 
registration information, messages sent or received with the payment, details of device 
used to arrange the payment and the payment method used; 

Information stored on your device, including if you give us access to contact information 
from your contacts list. The Revolut app will regularly collect this information in order to 


stay up to date (but only if you have given us permission). 


Information about your location 
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If you have location services in the Revolut app switched on, we track your location using GPS 


technology. 


Information from your employer (for Revolut Business only) 


If your employer uses Revolut Business and nominates you as a Revolut cardholder or account 
user, your employer will provide us with information about you. Typically, this will include your 


name and business contact details. 


If your employer nominates you as a Revolut Business cardholder or account user, we will also 


get information about: 


e how you use your Revolut Business card; 
e any transactions you make with your Revolut Business card; and 


e your device (as explained above). 


Information from others 


We collect personal data from third parties, such as credit-reference agencies, financial or credit 
institutions, official registers and databases, as well as fraud-prevention agencies and partners 


who help us to provide our services. 


This includes your credit record, information about late payments, information to help us check 
your identity, information about your spouse and family (if applicable in the context of an 


application for credit that you make) and information relating to your transactions. 
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When you ask us to, we will also collect personal data from accounts you hold with third party 
banks (and some accounts with third party providers that aren't banks) so that you can see 
everything in one place in your Revolut app. You can create a linked account by activating Open 


Banking in the app. 


Information from social media 


Occasionally, we will use publicly available information about you from selected social media 
websites or apps to carry out enhanced due diligence checks. Publicly available information 
from social media websites or apps may also be provided to us when we conduct general 
searches on you (for example, to comply with our anti-money laundering or sanctions screening 


obligations). 


If you are a Revolut Business customer, we may collect information about you if you make it 
publicly available on social media websites or apps. We only do this as part of our Revolut 
Business KYC checks. For example, if you have not yet set up a website for your business, we 
may need to look at information available on social media websites or apps to make sure your 


business is legitimate. 


Information from publicly available sources 


We collect information and contact details from publicly available sources, such as media 
stories, online registers or directories, and websites for enhanced due diligence checks, security 


searches, and KYC purposes for Revolut Business customers. 
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Revolut Business Customers 
BUSINESS CUSTOMERS 


If you are a Revolut Business customer, we will need to confirm your identity as part of our KYC 
process. We will ask you to provide documents, and will also collect information from third 


parties, such as commercial registers, for this purpose. 


4. What is your legal basis for using my personal data? 


We must have a legal basis (a valid legal reason) for using your personal data. Our legal basis 


will be one of the following. 


Keeping to our contracts and agreements with you 


We need certain personal data to provide our services and cannot provide them without this 


personal data. 


Legal obligations 


In some cases, we have a legal responsibility to collect and store your personal data (for 
example, under anti-money laundering laws we must hold certain information about our 


customers). 


Legitimate interests 
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We sometimes collect and use your personal data, or share it with other organisations, because 
we have a legitimate reason to use it and this is reasonable when balanced against your right to 


privacy. 


Consent 


Where you've agreed to us collecting your personal data, for example when you have ticked a 


box to indicate you are happy for us to use your personal data in a certain way. 


We have explained more about how we use your personal data in the How do you use my 


personal data? section below. 


Substantial public interest 


Where we process your sensitive personal data (Sometimes known as special category personal 
data) to adhere to government regulations or guidance, such as our obligation to support you if 


you are or become a vulnerable customer. 


5. How do you use my personal data? 


We use your personal data so we can provide the best service, tell you about products and 


services you may be interested in, and meet our legal obligations. 


PROVIDING OUR SERVICES 
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Whenever you apply for a product or service, we will use your personal data to check your 


identity (as part of our KYC process) and decide whether or not to approve your application. 


If you are already a Revolut customer, we use your personal data to meet our obligations relating 
to any transactions you make (for example, making payments into and out of your Revolut 
account, withdrawing cash or making payments with your Revolut Card). If you ask us to 
exchange the currency of the money or (e-money) you hold in your Revolut account, we'll use 


your personal data to help us do that. 


Where you hold a credit product with us, we use your personal data to recover debt and exercise 


other rights we have under any agreement we have with you. 


We use your personal data to give you details of our products and services and to help us 


develop new products and services. 


We use your personal data to contact you by phone and provide you with information about our 
products or services, as well as customer support services. We may monitor or record any 
communications between you and us, including phone calls, to maintain appropriate records, 
check your instructions, analyse, assess and improve our services, and for training and quality 


control purposes. 


Revolut Junior is our account for children and teenagers aged between 7 and 17. We have a 


separate Data Privacy Statement for Revolut Junior that explains how we process Revolut 
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Junior customers’ personal data. The Data Privacy Statement is specifically designed to be 


understood by children and teenagers. 


HERE'S AN EXAMPLE OF HOW WE USE YOUR PERSONAL DATA TO PROVIDE OUR SERVICES 


If you apply for a credit product, we or our lending partner (the provider of the credit product) will 
carry out a credit check to better understand your financial circumstances and repayment 


history. 


Our legal basis is one or more of the following: 


e keeping to contracts and agreements between you and us; 
e legitimate interests (we need to be efficient about how we meet our obligations and we 
want to provide you with good products and services); or 


e legal obligations. 


PROTECTING AGAINST FRAUD 


We use your personal data to check your identity to protect against fraud, keep to 
financial-crime laws and to confirm that you are eligible to use our services. We also use it to 
help us better understand your financial circumstances and manage fraud risks related to your 


Revolut account. 


HERE'S AN EXAMPLE OF HOW WE USE YOUR PERSONAL DATA TO PROTECT AGAINST FRAUD 
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If you have switched on location services in the Revolut app and your mobile phone tells us that 
you're in the United Kingdom, but your Revolut Card is being used in Spain, we may not process 


that transaction. 


Our legal basis is one or more of the following: 


e keeping to contracts and agreements between you and us; 
e legitimate interests (to develop and improve how we deal with financial crime and meet 
our legal responsibilities); or 


e legal obligations. 


MARKETING AND PROVIDING NEW PRODUCTS AND SERVICES THAT MIGHT INTEREST YOU 
We use your personal data to do the following: 


e provide you with information about other products and services we offer that are similar 
to those you have already used (or asked about, where allowed by law); 

e provide you with information about our products or services which we think you might be 
interested in. To help us do this, we may use information about you to help us better 
understand your interests. You can opt out of this by using the privacy settings in the 
Revolut app or by emailing our Data Protection Officer at dpo@revolut.com. 

e if you agree, provide you with information about our partners’ promotions or offers which 
we think you might be interested in; 

e if you agree, allow our partners and other organisations to provide you with information 
about their products or services; 

e measure or understand the effectiveness of our marketing and advertising, and provide 
relevant advertising to you; 


e ask your opinion about our products or services; 
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e process applications for products and services available through us, and make decisions 


about whether to approve applications. 


Remember, you can ask us to stop sending you marketing information by adjusting your 
marketing choices (the Do you use my personal data for marketing? section below explains how 
to do this). 


HERE'S AN EXAMPLE OF HOW WE USE YOUR PERSONAL DATA FOR MARKETING 


If you are a Revolut customer, we may contact you about optional extras or promotional offers. 
We may use personal data we gather about you through your use of our services to tailor these 


offers to you. 


Our legal basis is one or both of the following: 


e legitimate interests (to develop our products and services, define types of customers for 
new products or services, and to be efficient about how we meet our legal and 
contractual duties); or 


e consent (for you to receive marketing from other organisations). 


TO KEEP OUR SERVICES UP AND RUNNING 


We use your personal data to manage our website and the Revolut app, (including 
troubleshooting, data analysis, testing, research, statistical and survey purposes), and to make 
sure that content from our website is presented in the most effective way for you and your 


device. For more information, please see our Cookies Policy. 
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We also use your personal data to allow you to take part in interactive features of our services, 
to tell you about changes to our services, and to help keep our website and the Revolut app safe 


and secure. 


HERE'S AN EXAMPLE OF HOW WE USE YOUR PERSONAL DATA TO RUN OUR SERVICES 


If any changes we make to our services affect you, we'll normally contact you using the email 
address you gave us when you signed up, or through the Revolut app, to tell you about the 


changes. 


Our legal basis is one or more of the following: 


e keeping to contracts and agreements between you and us; 
e legitimate interests (to be efficient about how we meet our obligations and keep to 
regulations that apply to us); or 


e consent (where required by law). 


HELPING WITH SOCIAL INTERACTIONS 


We use your personal data to help social interactions through our services or to add extra 


functions in order to provide a better experience. 
HERE'S AN EXAMPLE OF HOW WE USE YOUR PERSONAL DATA FOR SOCIAL INTERACTIONS 
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We'll let you know if any Revolut customers are in the same area as you (if you and they have 


location services switched on). 


If you give us permission, we'll use the contacts list on your phone, so you can easily make 
payments to your contacts using the Revolut app or upload photos to your savings vaults in the 


Revolut app. 


Our legal basis is one or both of the following: 


e legitimate interests (to develop our products and services and to be efficient in meeting 
our obligations); or 
e consent (to access information held on your phone (for example, contacts in your 


contacts list), to track you when you have location services switched on). 


PROVIDING LOCATION-BASED SERVICES 


We use your personal data to provide relevant advertising to you (for example, information on 
nearby merchants), to protect against fraud, and to let you know when any of your contacts who 


are Revolut customers are in the same area as you (if they have location services switched on). 


HERE'S AN EXAMPLE OF HOW WE USE YOUR LOCATION INFORMATION 


If you go abroad, the Revolut app may automatically tell you the exchange rate in that country. 
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Our legal basis is one or more of the following: 


e keeping to contracts and agreements between you and us; 
e legitimate interests (to develop and market our obligations and keep to regulations that 
apply to us); or 


e consent (to track you when you have location services switched on). 


PREPARING ANONYMISED STATISTICAL DATASETS 


We prepare anonymised statistical datasets about our customers’ spending patterns for 
forecasting purposes or to help governments in policy-making. These datasets may be shared 
internally or externally with others, including non-Revolut companies. We produce these reports 
using information about you and other customers. The information used and shared in this way 
is never personal data and you will never be identifiable from it. Anonymised statistical data 


cannot be linked back to you as an individual. 


Our legal basis is one or both of the following: 


e legitimate interests (to conduct research and analysis, including to produce statistical 
research and reports); or 


e legal obligations. 


HERE'S AN EXAMPLE OF WHY WE MAY ANONYMISE YOUR PERSONAL DATA 


Some countries ask us to report spending statistics and how money enters or leaves each 
country. We may provide anonymised statistical information that explains the broad categories 


of merchants that Revolut customers in that country spend their money with. We may also 
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provide information about how Revolut customers top up their accounts and transfer money in 
that particular country. However, we will not provide any customer-level information. It will not 


be possible to identify any individual Revolut customer. 


MEETING OUR LEGAL OBLIGATIONS, ENFORCING OUR RIGHTS AND OTHER LEGAL USES 
We may need to share personal data about you: 


e with other organisations (for example, fraud-prevention agencies); 
e if this is necessary to meet our legal obligations or in connection with legal claims; or 


e to help detect or prevent crime. 


You can find out more in the Do you share my personal data with anyone else? section below. 
Our legal basis is one or more of the following: 


e legitimate interests (to keep to laws and regulations that apply to us); 
e substantial public interest (if we process your sensitive personal data to keep to legal 
requirements that apply to us); or 


e legal obligations. 


6. Do you make automated decisions about me? 


Depending on the Revolut products or services you use, we may make automated decisions 


about you. 
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This means that we may use technology that can evaluate your personal circumstances and 
other factors to predict risks or outcomes. We do this for the efficient running of our services 


and to ensure decisions are fair, consistent and based on the right information. 


Where we make an automated decision about you you have the right to ask that it is manually 
reviewed by a person. You can find out more about this in the What are my rights? section 


below. 


For example, we may make automated decisions about you that relate to: 
Approving credit applications: 


e credit and affordability checks to see whether we can accept your credit application; or 


e setting credit limits. 
Opening accounts: 


e anti-money laundering and sanctions checks; and 


e identity and address checks. 
Detecting fraud: 

e monitoring your account to detect fraud and financial crime. 
Our legal basis is one or both of the following: 


e keeping to contracts and agreements between you and us; or 


e legal obligations. 
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7. Do you carry out credit checks about me? 


We and our lending partners will use credit-reference agencies (or other providers of credit 
information in relevant countries) to carry out credit checks on you if you apply (or tell us you 


want to apply) for a credit product through Revolut. 


We will also share your personal data with credit-reference agencies (or other providers of credit 


information) to: 


e confirm details you have provided when you apply for products or services; 
e make an assessment about whether to accept your credit application; or 


e determine an appropriate credit limit for you. 


When you enter into a credit agreement with us we may continue sharing information with credit 
reference agencies or other providers of credit information (for example, information about your 


repayments and whether you repay in full or on time). 


The personal data we share with and receive from credit reference agencies (or other providers 
of credit information) when you apply for, or use, a Revolut credit product will vary depending on 


the country you live in. We will provide full details when you apply for a Revolut credit product. 


For UK users only 


If you are located in the United Kingdom, we may also check your credit history to help us 


develop and, in the future, offer credit products that meet the needs of our customers. This will 
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enable us to pre-filter the credit products that you may be eligible for and, in some cases, let you 


know before you apply if you will be accepted for a Revolut credit product. 


However, if you would prefer that we do not use your data in this way you can use the privacy 


settings in the Revolut app to opt out. 


Credit-reference agencies will not store any of your information that we send them when we use 
their services for this purpose and these checks do not leave any ‘footprint’ (trace) whatsoever 


on your credit record held by the credit-reference agency. 


The three main credit-reference agencies Revolut uses are: 


e TransUnion (www.transunion.com); 
e Equifax (www.equifax.com); and 
e Experian (www.experian.com). 


Our legal basis is one or more of the following: 


e consent (where we are required to collect your consent by law); 

e legal obligations; 

e keeping to contracts and agreements between you and us (where you take out a credit 
product with us); or 

e legitimate interests (to develop and, in the future, offer credit products to our 


customers). 
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8. How do you use my personal data for marketing? 


If you sign up to our services, and where allowed by law, we will assume you want us to contact 
you by post, email and SMS text message with information about Revolut products, services, 
offers and promotions. We may use the personal data we have collected about you in order to 


tailor our offers to you. 


You can adjust your preferences, or tell us you don't want to hear from us, at any time. Just use 
the privacy settings in the Revolut app or click on the unsubscribe links on any marketing 


message we send you. 


We won't pass your details on to any organisations outside the Revolut group of companies for 


their marketing purposes without your permission. You can find out more in the Do you share 


my personal data with anyone else? section. 


Your rights 


9. What are my rights? 


You have the right to be told about how we use your personal data. 


e We provide this privacy policy to explain how we use your personal data. 

e If you ask, we will provide a copy of the personal data we hold about you. We can't give 
you any personal data about other people, personal data which is linked to an ongoing 
criminal or fraud investigation, or personal data which is linked to settlement 
negotiations with you. We also won't provide you with any communication we've had 


with our legal advisers. 
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You can ask us to correct your personal data if you think it's wrong. 


e You can have incomplete or inaccurate personal data corrected. Before we update your 


file, we may need to check the accuracy of the new personal data you have provided. 
You can ask us to delete your personal data. 


You can ask us to delete your personal data if: 


e there's no good reason for us to continue using it; 

e you gave us consent (permission) to use your personal data and you have now 
withdrawn that consent; 

e you have objected to us using your personal data; 

e we have used your personal data unlawfully; or 


e the law requires us to delete your personal data. 


Just to let you know, we may not be able to agree to your request. As a regulated financial 
services provider, we must keep certain customer personal data even where you ask us to delete 
it (we've explained this in more detail below). If you've closed your Revolut account, we may not 
be able to delete your entire file because these regulatory responsibilities take priority. We will 


always let you know if we can't delete your personal data. 


You can object to us processing your personal data for marketing purposes. 
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You can tell us to stop using your personal data for marketing. 


You can object to us processing other personal data (if we are using it for legitimate interests). 


If our legal basis for using your personal data is ‘legitimate interests’ and you disagree 
with us using it, you can object. 

However, if there is an overriding reason why we need to use your personal data, we will 
not accept your request. 

If you object to us using personal data which we need in order to provide our services, 


we may need to close your account as we won't be able to provide the services. 


You can ask us to restrict how we use your personal data. 


You can ask us to suspend using your personal data if: 


you want us to investigate whether it is accurate; 

our use of your personal data is unlawful but you do not want us to delete it; 

we no longer need your personal data, but you want us to continue holding it for you in 
connection with a legal claim; or 

you have objected to us using your personal data (see above), but we need to check 


whether we have an overriding reason to use it. 


You can ask us to transfer personal data to you or another company. 


If we can, and are allowed to do so under regulatory requirements, we will provide your 


personal data in a structured, commonly used, machine-readable format. 
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You can withdraw your permission. 


e If you have given us any consent we need to use your personal data, you can withdraw 
your consent at any time by changing your privacy settings in the Revolut app or sending 


an email to dpo@revolut.com. 


(Note, it will have been lawful for us to use the personal data up to the point you withdrew your 


permission). 


You can ask us to carry out a human review of an automated decision we make about you. 


e |f we make an automated decision about you that significantly affects you, you can ask 


us to carry out a manual review of this decision. 


Your ability to exercise these rights will depend on a number of factors. Sometimes, we will not 
be able to agree to your request (for example, if we have a legitimate reason for not doing so or 


the right does not apply to the particular information we hold about you). 


10. How do | exercise my rights? 


To exercise any of your rights set out in the previous section, you can contact us through the 


Revolut app or send us an email at dpo@revolut.com. 
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For security reasons, we can't deal with your request if we are not sure of your identity, so we 


may ask you for proof of your ID. 


Revolut will usually not charge you a fee when you exercise your rights. However, we are allowed 
by law to charge a reasonable fee or refuse to act on your request if it is manifestly unfounded 


or excessive. 


If you are unhappy with how we have handled your personal data you can complain to your local 
data protection authority. In the United Kingdom, this is the ICO website. In the EU, there are 


national and regional data protection authorities (a list is available on this website). 


11. Do you share my personal data with anyone else? 


REVOLUT GROUP COMPANIES 


We share your personal data within the Revolut group of companies in order to provide you with 


the best service. 


OTHER REVOLUT CUSTOMERS 


We will ask you to let us sync your mobile phone contacts. This will help you to identify which of 
your trusted mobile phone contacts are Revolut customers. Your ‘trusted contacts’ will also be 


able to see if you are a Revolut customer through our ‘Payment with Friends’ functionality. 
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‘Payment with Friends’ gives you access to Revolut features like requesting money from your 


friends, splitting bills, group vaults and paying other Revolut customers near you. 


We use technological safeguards to ensure a ‘trusted contact’ is somebody you already know 
and who knows you (for example, you have each other saved in each other's mobile phone 
contacts lists or have already received or given money through a peer-to-peer payment with 


them). 


Both you and your trusted contact must have synced your mobile phone contacts lists with 


Revolut to be viewable to each other in the Revolut app. 


We only show your basic contact details in the Revolut app to your trusted contacts who are 
also Revolut customers (for example, your name (as saved in your friend’s contacts list), mobi 


phone number, Revolut username, your Revolut profile photo (if you have one)). 


le 


You can, of course, choose not to sync your contacts list with Revolut. This means that you will 


not be able to identify which of your mobile phone contacts are Revolut customers. 


You can also turn off ‘Payments with Friends’ through the privacy settings in the Revolut app. 


PEOPLE OR COMPANIES THAT YOU TRANSFER MONEY TO 
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Where you make a payment from your Revolut account, we will provide the recipient with your 


details (for example, your full legal name and IBAN). 


SUPPLIERS 


The table below explains which suppliers we normally share your personal data with. 


Suppliers who provide us with IT, payment and delivery services 


e To help us provide our services to you. 


Our banking and financial-services partners and payments networks, including Visa and 


Mastercard 


e To help us provide our services to you - this includes banking and lending partners, 


banking intermediaries and international payment-service providers. 


Card manufacturing, personalisation and delivery companies 


e To create and deliver your personalised Revolut Card. 


Analytics providers and search information providers 


e To help us improve our website or app. 
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Customer-service providers, survey providers and developers 


e To help us to provide our services to you. 


Communications services providers 


e Tohelp us send you emails, push notifications and text messages. 


Debt collection agencies 


e To manage and recover debts that you owe or may become owing if you have a Revolut 


credit product. 


THIRD PARTY PAYERS 


We may share your name with third parties that pay money into your Revolut account. This is 


necessary to confirm that the payment has been made to the correct account. 


PARTNERS WHO HELP TO PROVIDE OUR SERVICES 


We may share your personal data with our partners in order to provide you with certain services 
you have asked us for (for example, when we offer overseas medical insurance as part of our 


Premium or Metal plans). 
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If you are a Revolut Business customer, we may share your personal data with our partners 


(through the Revolut Business API) when you switch this function on through Revolut Connect. 


HERE'S AN EXAMPLE OF WHEN WE MIGHT SHARE YOUR PERSONAL DATA WITH OUR 
PARTNERS 


If you have asked for insurance services, we will share your relevant personal data with the 
provider of our insurance services. The service provider will require your personal data to 


provide you with insurance. 


We will only share your personal data in this way if you have asked for the relevant service or it 


is provided as part of one of our plans. 


From time to time we may work with other partners to offer you co-branded services or 
promotional offers, and we will share some of your personal data with those partners. We will 
always make sure you understand how we and our partners process your personal data for 


these purposes. 


Our partners will have their own privacy policies explaining how they use your personal data. It's 
important that you read those privacy policies as well. For example, our third party insurance 
provider, White Horse Ireland dac, will process your personal data in accordance with its own 


privacy policy. 
CREDIT-REFERENCE AGENCIES 


29 


Revolut 


As set out at the Do you carry out credit checks about me? section, if you apply for a credit 


product, we'll share your personal data with credit-reference agencies to check whether you are 


likely to make repayments when due. 


OTHER FINANCIAL INSTITUTIONS 


We may share your personal data with other financial institutions if requested. 


HERE'S AN EXAMPLE OF WHEN WE MIGHT SHARE YOUR PERSONAL DATA WITH OTHER 
FINANCIAL INSTITUTIONS 


If you have activated ‘Open Banking’ through an account you hold with another financial 
institution and given them permission, we will share data from your Revolut account with that 


financial institution. 


We may also share your personal data with other financial institutions where you do not ask us 


to. For example: 


e if you make an outbound payment, we share information about you alongside your 
payment. This is because we, like all payment institutions, are required by law to include 
certain information with payments; and 

e if apayment is made to your account by mistake, we can share your information with the 
financial institution the payment came from. This will help the payer and the other 


financial institution to try and get the payment back themselves. 


FOR LEGAL REASONS 
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We also share your personal data with fraud-prevention agencies to check your identity, protect 
against fraud, keep to anti-money laundering laws and confirm that you are eligible to use our 


products and services. 


HERE'S AN EXAMPLE OF WHEN WE MIGHT SHARE YOUR PERSONAL DATA FOR LEGAL 
REASONS 


If you give us false or inaccurate personal data and we identify fraud, we will let fraud-prevention 


agencies know. Law-enforcement agencies may check and use this personal data. 


If fraud is detected, you could be refused certain services, finance or employment. You can 
contact us through the Revolut app to ask us for details of the fraud-prevention agencies we 


may share your personal data with. 


We may also need to share your personal data with other third party organisations: 


e if we have to do so under any law or regulation; 

e if we sell our business; 

e in connection with criminal or fraud investigations; 

e to enforce our rights (and those of customers or others); or 


e in connection with legal claims. 


SOCIAL MEDIA AND ADVERTISING COMPANIES 


HERE'S AN EXAMPLE OF WHEN WE MIGHT SHARE YOUR PERSONAL DATA FOR ADVERTISING 
PURPOSES 
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We may share your personal data (your name, email address and app events) with our 
advertising partners in the ways described below, but the personal data is hashed before we 
send it, and the social-media platform we share it with is only allowed to use that hashed 


personal data in the ways described below. 


When we use social media for marketing purposes, your personal data may be shared with the 
social-media platforms so that they can check if you also hold an account with them. If you do 


we may ask the advertising partner or social-media provider to: 


e use your personal data to send our adverts to you, because we think that you might be 
interested in a new Revolut product or service; 

e not send you our adverts, because the marketing relates to a service that you already 
use; or 

e send our adverts to people who have a similar profile to you (for example, if one of our 


services is particularly useful to people with similar interests to the ones on your 


ri 


social-media profile, we may ask our advertising partner or social-media partner to send 


our adverts for that service to those people). 


An example of how we may use social media for marketing purposes is through Facebook's 


‘Custom Audience’ tool, the terms of which are available here. 


Our legal basis is: 


e legitimate interests. 
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You can contact us at any time, either through the Revolut app or by emailing dpo@revolut.com, 
if you do not want us to share your personal data for advertising purposes. You can also use the 


privacy settings in the Revolut app to opt out from having your personal data shared in this way. 


Remember you can also manage your marketing preferences directly with any social media 


provider that you have an account with. 


WHERE YOU ASK US TO SHARE YOUR PERSONAL DATA 


Where you direct us to share your personal data with a third party, we may do so. For example, 
you may authorise third parties to act on your behalf (such as a lawyer, accountant or family 


member or guardian under a power of attorney). 


Revolut and your personal data 


12. Will my personal data go outside of the United Kingdom or Europe? 


As we provide an international service, we may need to transfer your personal data outside the 


United Kingdom or European Economic Area (EEA) in order for us to provide our services. 


For example, if you ask to make an international payment, we will send funds to banks outside 
of the United Kingdom or EEA. We might also send your personal data outside of the United 
Kingdom or EEA to keep to global legal and regulatory requirements, and to provide ongoing 


support services. 
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We may share your personal data with credit-reference agencies and fraud-prevention agencies 


that are based outside of the United Kingdom or EEA. 


We will take all reasonable steps to make sure that your personal data is handled securely and 


in line with this privacy policy and data protection laws. 


If you would like more information, please contact us through the Revolut app or by sending an 


email to dpo@revolut.com. 


13. How do you protect my personal data? 


We recognise the importance of protecting and managing your personal data. Any personal data 
we process will be treated with the utmost care and security. This section sets out some of the 


security measures we have in place. 


We use a variety of physical and technical measures to keep your personal data safe and 
prevent unauthorised access to, or use or disclosure of it. Electronic data and databases are 
stored on secure computer systems with control over access to information using both physical 
and electronic means. Our staff receives data protection and information security training. We 
have detailed security and data protection policies which staff are required to follow when they 


handle your personal data. 
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While we take all reasonable steps to ensure that your personal data will be kept secure from 
unauthorised access, we cannot guarantee it will be secure during transmission by you to our 
app, a website or other services. We use HTTPS (HTTP Secure), where the communication 
protocol is encrypted through Transport Layer Security for secure communication over 


networks, for all our app, web and payment-processing services. 


If you use a password for the Revolut app or our website, you will need to keep this password 


confidential. Please do not share it with anyone. 


When you use our services, which includes our social network accounts and the Revolut 
Community forum, do not share any personal data that you don't want to be seen, collected or 


used by other customers, as this personal data will become publicly available. 


14. How long will you keep my personal data for? 


We will generally keep your personal data for six years after our business relationship with you 


ends or such period as may be required by applicable local laws. However, if you receive 


services from our Lithuanian group companies, Revolut Bank UAB or Revolut Payments UAB, we 


will keep your personal data for eight years after our business relationship with you ends. 


We are required to keep your personal data for this long by anti-money laundering and e-money 


laws. We may keep your personal data for longer because of a potential or ongoing court claim 


or another legal reason. 
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15. How will you keep me updated on how you use my personal data? 


If we change the way we use your personal data, we will update this policy and, if appropriate, let 


you know by email, through the Revolut app or through our website. 


16. Do you use cookies on your websites? 


We use cookies to analyse how you use our website. Please read the Cookies Policy for more 


information about cookies. 
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